After the breach of Onamae.com Desktop Cloud, a $1 million bounty and a white-hat investigation grabbed attention. The harder question is what affected customers will actually receive.
“We may have a lead on the attacker!”
Good. Following the evidence and helping the police could prevent further harm. But someone whose trading account was affected has a less cinematic question: “What happens to my money?”
A detective story is exciting. Bank balances do not wait for the final episode.
The incident behind the headlines
According to GMO Internet, a customer inquiry triggered an investigation on October 19, 2026. The company found unauthorized software on October 20 and began shutting down the affected Desktop Cloud servers on October 21. GMO acknowledged security weaknesses, unauthorized access and data taken from its environment. Some customers reported trades they had not authorized.[1]
On October 29, GMO said its white-hat security team had obtained information believed to help identify the offender and intended to share it with police. It also announced a reward program capped at US$1 million in total for useful tips.[2] A promising lead is not the same as a confirmed identity or arrest.
Was the attacker really an amateur?
A security expert quoted in Japanese reporting suggested the attacker might be inexperienced.[3] That is an assessment, not an established identity. Social-media descriptions of a “broke amateur” should not be presented as biographical facts.
Still, the contrast is striking: a company can talk about a formidable security team while customers read a notice about stolen data. It feels like seeing an advertisement for a fortress, then learning the front desk is taking reports about a missing safe.
There is a real distinction: incident investigation and prevention require different skills. Finding digital footprints after an attack does not guarantee that every weakness was closed beforehand. The meaningful questions are where the intrusion began, how quickly it was detected and how the damage was contained.
What compensation has GMO actually promised?
GMO has made concrete announcements. On October 24 it promised ¥5,000 to each eligible current user and compensation for realized losses and fees from unauthorized trades it determines were caused by this incident. Reimbursements from trading platforms are deducted. The policy excludes market-movement losses, hypothetical profits and indirect damages.[1]
GMO also announced additional payments for users whose exposed information was confirmed to have been published: ¥10,000 for basic personal information, ¥15,000 for financial or login credentials, and ¥25,000 for sensitive information categories, with the categories handled separately from the ordinary consolation payment and trade-loss compensation.[4]
That is an announced policy, not evidence that every valid claim has already been paid. GMO said further application and payment details would be provided by November 6.[1] As of October 30, the cited notices do not establish total payouts or how many claims have been accepted.
Comparing a total bounty cap with an individual ¥5,000 payment would be misleading; the money serves different purposes. Yet customers have every reason to ask for a compensation receipt, not merely a criminal-investigation headline.
The scorecard customers deserve
Useful accountability would publish how fast exposure was contained, how many compensation claims were approved or rejected, the sums actually paid, and what security changes were independently checked. The offender remains responsible for the attack; the service provider must explain how it protected the people who trusted it. Those duties can move forward simultaneously.
A hundred security specialists might look impressive on a slide. They cannot fill a blank line on a customer's bank statement.
Before the victory lap, show the reimbursement.
References (4)
- GMO Internet / お名前.com, 2026-10-24, 第4報：侵入確認・時系列・一律5,000円・実現損失と手数料の補償条件・11月6日案内予定。 onamae.com
- GMO Internet / お名前.com, 2026-10-29, 第15報：ホワイトハッカーチームの有力情報と警察への提出方針、情報提供の募集。 onamae.com
- 関西テレビ、2026-10-29：専門家による攻撃者像の推測（素人の可能性）。 ktv.jp
- GMO Internet, 2026-10-27, 第12報：情報公開に応じた特別お見舞金と、最大100万米ドルの懸賞金。 internet.gmo
